Planning and Scoping – 15%

• Confidentiality of findings
• Known vs. unknown

– Budget
– Impact analysis and remediation timelines
– Disclaimers

• Point-in-time assessment
• Comprehensiveness

– Technical constraints
– Support resources

• WSDL/WADL
• SOAP project file
• SDK documentation
• Swagger document
• XSD
• Sample application requests
• Architectural diagrams

• SOW
• MSA
• NDA

– Environmental differences

• Export restrictions
• Local and national government restrictions
• Corporate policies

– Written authorization

• Obtain signature from proper signing authority
• ​Third-party provider authorization when necessary

• Goals-based/objectives-based
• Compliance-based
• Red team

– Special scoping considerations

• Premerger
• Supply chain

– Target selection

• Targets
  1. Internal
  – On-site vs. off-site
  2. External
  3. First-party vs. third-party hosted
  4. Physical
  5. Users
  6. SSIDs
  7. Applications
• Considerations
  1. White-listed vs. black-listed
  2. Security exceptions
  – IPS/WAF whitelist
  – NAC
  – Certificate pinning
  – Company’s policies

– Strategy

• Black box vs. white box vs. gray box

– Risk acceptance
– Tolerance to impact
– Scheduling
– Scope creep
– Threat actors

• Adversary tier
  1. APT
  2. Script kiddies
  3. Hacktivist
  4. Insider threat
• Capabilities
• Intent
• Threat models

• Rules to complete assessment
• Password policies
• Data isolation
• Key management
• Limitations
  1. Limited network access
  2. Limited storage access

– Clearly defined objectives based on regulations

Information Gathering and Vulnerability Identification – 22%

• Hosts
• Networks
• Domains
• Users
• Groups
• Network shares
• Web pages
• Applications
• Services
• Tokens
• Social networking sites

– Packet crafting
– Packet inspection
– Fingerprinting
– Cryptography

• Certificate inspection

– Eavesdropping

• RF communication monitoring
• Sniffing
  1. Wired
  2. Wireless

– Decompilation
– Debugging
– Open Source Intelligence Gathering

• Sources of research
  1. CERT
  2. NIST
  3. JPCERT
  4. CAPEC
  5. Full disclosure
  6. CVE
  7. CWE

• Discovery scan
• Full scan
• Stealth scan
• Compliance scan

– Container security
– Application scan

• Dynamic vs. static analysis

– Considerations of vulnerability scanning

• Time to run scans
• Protocols used
• Network topology
• Bandwidth limitations
• Query throttling
• Fragile systems/non-traditional assets

• False positives

– Prioritization of vulnerabilities
– Common themes

• Vulnerabilities
• Observations
• Lack of best practices

• Cross-compiling code
• Exploit modification
• Exploit chaining
• Proof-of-concept development (exploit development)
• Social engineering
• Credential brute forcing
• Dictionary attacks
• Rainbow tables
• Deception

Attacks and Exploits – 30%

• Spear phishing
• SMS phishing
• Voice phishing
• Whaling

– Elicitation

• Business email compromise

– Interrogation
– Impersonation
– Shoulder surfing
– USB key drop
– Motivation techniques

• Authority
• Scarcity
• Social proof
• Urgency
• Likeness
• Fear

• NETBIOS name service
• LLMNR

– SMB exploits
– SNMP exploits
– SMTP exploits
– FTP exploits
– DNS cache poisoning
– Pass the hash
– Man-in-the-middle

• ARP spoofing
• Replay
• Relay
• SSL stripping
• Downgrade

– DoS/stress test
– NAC bypass
– VLAN hopping

• Karma attack
• Downgrade attack

– Deauthentication attacks
– Fragmentation attacks
– Credential harvesting
– WPS implementation weakness
– Bluejacking
– Bluesnarfing
– RFID cloning
– Jamming
– Repeating

• SQL
• HTML
• Command
• Code

– Authentication

• Credential brute forcing
• Session hijacking
• Redirect
• Default credentials
• Weak credentials
• Kerberos exploits

– Authorization

• Parameter pollution
• Insecure direct object reference

– Cross-site scripting (XSS)

• Stored/persistent
• Reflected
• DOM

– Cross-site request forgery (CSRF/XSRF)
– Clickjacking
– Security misconfiguration

• Directory traversal
• Cookie manipulation

– File inclusion

• Local
• Remote

– Unsecure code practices

• Comments in source code
• Lack of error handling
• Overly verbose error handling
• Hard-coded credentials
• Race conditions
• Unauthorized use of functions/unprotected APIs
• Hidden elements
  1. Sensitive information in the DOM
• Lack of code signing

• Windows
• Mac OS
• Linux
• Android
• iOS

– Unsecure service and protocol configurations
– Privilege escalation

• Linux-specific
  1. SUID/SGID programs
  2. Unsecure SUDO
  3. Ret2libc
  4. Sticky bits
• Windows-specific
  1. Cpassword
  2. Clear text credentials in LDAP
  3. Kerberoasting
  4. Credentials in LSASS
  5. Unattended installation
  6. SAM database
  7. DLL hijacking
• Exploitable services
  1. Unquoted service paths
  2. Writable services
• Unsecure file/folder permissions
• Keylogger
• Scheduled tasks
• Kernel exploits

– Default account settings
– Sandbox escape

• Shell upgrade
• VM
• Container

– Physical device security

• Cold boot attack
• JTAG debug
• Serial console

• RPC/DCOM
  1. PsExec
  2. WMI
  3. Scheduled tasks
• PS remoting/WinRM
• SMB
• RDP
• Apple Remote Desktop
• VNC
• X-server forwarding
• Telnet
• SSH
• RSH/Rlogin

– Persistence

• Scheduled jobs
• Scheduled tasks
• Daemons
• Back doors
• Trojan
• New user creation

– Covering your tracks

Penetration Testing Tools – 17%

• oA
• oN
• oG
• oX

• Reconnaissance
• Enumeration
• Vulnerability scanning
• Credential attacks
  1. Offline password cracking
  2. Brute-forcing services
• Persistence
• Configuration compliance
• Evasion
• Decompilation
• Forensics
• Debugging
• Software assurance
  1. Fuzzing
  2. SAST
  3. DAST

– Tools

• Scanners
  1. Nikto
  2. OpenVAS
  3. SQLmap
  4. Nessus
• Credential testing tools
  1. Hashcat
  2. Medusa
  3. Hydra
  4. Cewl
  5. John the Ripper
  6. Cain and Abel
  7. Mimikatz
  8. Patator
  9. Dirbuster
  10. W3AF
• Debuggers
  1. OLLYDBG
  2. Immunity debugger
  3. GDB
  4. WinDBG
  5. IDA
• Software assurance
  1. Findbugs/findsecbugs
  2. Peach
  3. AFL
  4. SonarQube
  5. YASCA
• OSINT
  1. Whois
  2. Nslookup
  3. Foca
  4. Theharvester
  5. Shodan
  6. Maltego
  7. Recon-NG
  8. Censys
• Wireless
  1. Aircrack-NG
  2. Kismet
  3. WiFite
• Web proxies
  1. OWASP ZAP
  2. Burp Suite
• Social engineering tools
  1. SET
  2. BeEF
• Remote access tools
  1. SSH
  2. NCAT
  3. NETCAT
  4. Proxychains
• Networking tools
  1. Wireshark
  2. Hping
• Mobile tools
  1. Drozer
  2. APKX
  3. APK studio
• MISC
  1. Searchsploit
  2. Powersploit
  3. Responder
  4. Impacket
  5. Empire
  6. Metasploit framework

• Looping
• Flow control

– I/O

• File vs. terminal vs. network

– Substitutions
– Variables
– Common operations

• String operations
• Comparisons

– Error handling
– Arrays
– Encoding/decoding

Reporting and Communication – 16%

• Executive summary
• Methodology
• Findings and remediation
• Metrics and measures
  1. Risk rating
• Conclusion

– Risk appetite
– Storage time for report
– Secure handling and disposition of reports

• Removing shells
• Removing tester-created credentials
• Removing tools

– Client acceptance
– Lessons learned
– Follow-up actions/retest
– Attestation of findings

• People
• Process
• Technology

– Findings

• Shared local administrator credentials
• Weak password complexity
• Plain text passwords
• No multifactor authentication
• SQL injection
• Unnecessary open services

– Remediation

• Randomize credentials/LAPS
• Minimum password requirements/password filters
• Encrypt the passwords
• Implement multifactor authentication
• Sanitize user input/parameterize queries
• System hardening